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ABSTRACT 


In this paper we develop the mathematical theory of proportional and scale change models 
to perform reliability analysis The results obtained will be applied for the reaction Control 
System (RCS) thruster valves on an orbiter. With the advent of extended EVA s 
associated with PROX OPS (ISSA & MIR), and docking, the loss of a thruster valve now 
takes on an expanded safety significance. Previous studies assume a homogeneous 
population of components with each component having the same failure rate. However, as 
various components experience different stresses and are exposed to different 
environments, their failure rates change with time. 

In this paper we model the reliability of a thruster valves by treating these valves as a 
censored repairable system. The model for each valve will take the form of a 
nonhomogeneous process with the intensity function that is either treated as a proportional 
hazard model, or a scale change random effects hazard model. Each component has an 
associated z, an independent realization of the random variable Z from a distribution G(z). 
This unobserved quantity z can be used to describe heterogeneity systematically. 

For various models methods for estimating the model parameters using censored data will 
be developed. Available field data (from previously flown flights) is from non-renewable 
systems. The estimated failure rate using such data will need to be modified for renewable 
systems such as thruster valve. 
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INTRODUCTION 


In this paper we develop the mathematical theory of proportional and scale change models 
to perform reliability analysis. The results obtained will be applied for the Reaction 
Control System (RCS) thruster valves on a space vehicle. With the advent of extended 
EVA’s associated with PROX OPS (ISSA & MIR), and docking to space station, the loss 
of a thruster valve now takes on an expanded safety significance. RCS thruster valves are 
installed on the orbiter at 38 locations, 14 in front (Forward) and 24 in the rear (Aft), 12 
on each side. At each location there is a fuel valve and an oxidizer valve. Thus there are a 
total of 76 valves on an orbiter. These inlet valves can leak due to various reasons. These 
include the shrinkage of the teflon seal due to extreme weather conditions, reduction in the 
teflon seal height above the seal retainer, and contamination deposits between the valve 
seat and poppet face. The mixing of moist air and residual oxidizer (N2O4) form metallic 
nitrates. It is believed that the metallic nitrates cause deposits to build up in the valves. 


The orbiter thruster valves have at least three failures modes. These are: (1) Nitrate build 
up so that the valve will not open (FAIL-OFF/CLOSED); (2) Nitrate deposits on the seat 
causes leaks and the valve will not close (FAIL-OFF/OPEN); and (3) Spontaneous leaks 
(FAIL OFF/LEAKS). The number of times a valve is opened or closed provide an 
indication of the amount of fluid flow which may be related to the contamination failure 
mechanism. Also, the amount of fluid each valve is subjected to varies substantially from 
each location. In the past several studies have been done in an attempt to estimate valve 
reliability. Studies done at Rockwell Aerospace have used cycle time as the casual 
variable, while studies done at JSC have used soak time as the casual variable. Only one 
variable was used in both of these studies since standard statistical computer models treat 
only one variable. In this paper we develop new statistical theory based on both variables. 
Also, previous studies assume a homogeneous population of components with each 
component having the same failure rate. However, as various components experience 
different stresses and are exposed to different environments, their failure rates can change 
across the population of components. Techniques which ignore the heterogeneity can 
result in incorrect estimates of failure distributions. 

We propose to model the reliability of the thruster valves by treating these valves as a 
censored repairable system. The system is repairable since valves that either leak or stick 
are removed, repaired and placed back in operation. Censoring occurs whenever the time- 
to-failure records are terminated before each valve has had a chance to fail. The model for 
each valve will take the form of a nonhomogeneous process with the intensity function 
that is either treated as a proportional hazard model, or a scale change random effects 
hazard model. 
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The proportional hazard function model will assume that the time the valve is soaked in 
the oxidizer prior to failure is the primary variable that describes the base hazard function 
and that the cycle time, and perhaps other variables, adjust this hazard. The scale change 
random effects model will also assume that there is a soak-time-hazard function for each 
valve, but in this case cycle time and other variables will be used to randomly scale the 
soak time. 

Thus for a given Z=z , the cumulative hazard function for proportional change and scale 
change models are given respectively by, 

H(t / Z=z) = z H(t), and H(t/Z=z) = H(zt), 

where H(t) is an unobserved cumulative baseline hazard function. Thus each component 
has an associated z, an independent realization of the random variable Z from a 
distribution G(z). This unobserved quantity z can be used to describe heterogeneity 
systematically. This variable z may represent environmental influences on different 
components, effects of microgravity, effect of location of components on the orbiter, and 
various other risk factors. 

For each of these models methods for estimating the model parameter using censored 
field data will be developed. The model which appears to best forecast failures of the 
Orbiter’s RCS thruster valves will then be selected as the appropriate model. 

To estimate the component life for components on a space vehicle (such as ISSA) , one 
needs to understand the mechanism that cause the failures of the components and 
component types. Ideally each component with a different vintage should be put on test 
under environmental and operational conditions identical to those under which it is to be 
operated, and time to failure be observed. This experiment needs to be repeated a number 
of times to get a reasonable size statistical sample. However it is not possible to conduct 
meaningful life tests on earth because of not being able to replicate the proper stress 
environment and also because of cost. Thus, the only available data on failure of 
components in microgravity is the field data obtained from previously flown spacecraft’s. 
This data needs to be adjusted because: 

1. The available data is from non-renewable systems, i.e., a failed component is not 
replaced. The failure rate distributions estimated using such data will need to be modified 
for renewable systems such as ISSA. 

2. Previous studies use the field data collected from sixties, seventies and eighties, and 
conclude that design and environment are the main contributors to failure. Assuming that 
how to design and knowledge about environment has improved substantially since sixties, 
this data need to be examined carefully. 
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MIXTURE MODELS UNDER HETEROGENEITY 

It is generally accepted that the lifetime of electronic components can be described by an 
exponential probability distribution, that is, 

/(/) = A. <?'*',/ >0,A >0 0) 

where A is a parameter which is the hazard rate. This model assumes constant failure rate 
for each component. However, in most cases the failure rate-age characteristic may rise or 
fall in addition to remaining constant. A probability distribution which can represent any 
form of failure rate-age curve is the Weibull distribution. The probability density function 
of this distribution is given by 

f(t) “ £(£)'■' . t> 0,/?,77 >0 (2) 

Exponential distribution (1) is a special case when ft =1. The cumulative distribution 
function, survival function S(t), and hazard function are given respectively by 

F{t) = 1 - ; Sit) = 1 - Fit)-andhit) = fa)*'' 

These models assume a homogeneous population of components with each component 
having the same failure rate. However, as various components on the orbiter are exposed 
to different environments and experience different stresses, their failure rates can change 
across the population of component types. In this paper we develop proportional and scale 
change models when the life-time distribution is given by (2). The failure model for each 
component will take the form of a non-homogeneous process with intensity function that 
is either treated as a proportional hazard model, or a scale change random effects hazard 
model. 


Proportional Hazard Model 

Under this model the lifetime of a component, T, has the cumulative hazard function, 

H(t / Z=z) = z H(t), where H(t) is an unobserved baseline cumulative hazard function, 
the same for each component. Each component has an associated z, an independent 
realization of a r.v. Z from a distribution G(z). This variable z (possibly a vector) can 
represent environmental influences on different components, effects of microgravity, 
effects of location on the orbiter, and various other risks factors. This unobserved quantity 
z can be used to describe heterogeneity systematically. 
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Case I: 


(3) 


Let g(:) = ifctfsr ' * \ s * 0 ,A.,.r > 0, then. 


S(t) = Ei S(t/Z=z) = fe'^j 


X 


and. 


h(t) = 


bw'J 

m±y-' 

-ihgS(0 = j^— 




*+(i> 


when t= 77 , the characteristic life is given by , 

h(0= -,-h 

We note from (4) that for given r, /?, 77 , A,, h(t) t— » 0 as t gets large. 


Case IT. 

Let g(z)= 1, 0<z< 1. 
In this case. 


set)- ; and h(,) = f - — 




(i) 


1 - e 




We note that h(t)i-4 0 as t gets large. 

Case III: Let g(z) be a 2 -point distribution, i.e. 

P(Z=z,) = p ; P(Z=z 2 )=l-p 


then. 


S(t) =p e~ hV/ '* + (1-P) e 




(4) 


(5) 


( 6 ) 


(7) 


The expression for the hazard rate, h(t) , is lenghty, but can be obtained easily. Also, it 
can be shown that h(t) i— > 0, as t gets large. 
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Scale change Hazard Models 


Under the scale cahnge hazard model the lifetime, T, has the cumulative hazard function, 
H(t / Z=z) = H(zt), where H(t) is an unobserved baseline hazard function, the same for 
all components. In this case, 

oo 

S(t/Z=z) = and S(t) = J dG(z), (8) 

0 


Case I: 


Let Z has the gamma distribution given by (3), then from ( 8 ) 


S(t) = J e * (;) • T £y(Z-r) r 'e'^dz, and h(t) = - log S(t) can be computed and 


the resulting integral can be evaluated numerically. 


Case II: 


Let Z has the Weibull distribution given by (2) with rj replaced by 5 . In this case. 


P ( t 


S(t) = 


C 1 ) 

— f — 7 7 ? , and h(t) = — ^ 


( 9 ) 


we note that h(t) h 0 ast gets large. 

Case III: 

Let Z has the uniform distribution given by (5). In this case. 


S(t) = je * ^ dz, and h(t) = } 


1 - 


e ’ 


( 10 ) 


S(t) needs to be evaluated numerically. It can be shown that h(t)i — > 0 as t gets large. 


Case IV: 

Let Z has the 2-point distribution given by (7). In this case 


h(t) 


= p p:fe' z ' ^ +(l-p)z,V' : <?) J , 


( 11 ) 


Where z \ , zi are particular values of Z. It is clear from (11) that h(t) — » 0 as t gets large. 
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A Regression Model 

Assume that for a given value z of a random variable Z, the regression of logT on log z is 
linear, that is, 

logT = loga + b logz +log£- (12) 

where a is a constant From (12) T = a z b e , S(t/z) = P(T > t/z) = P(e > -^r /z), and 

S(t) = \P{e>ij)g{z)dz, (13) 

where g(z) is the density of Z. This integral can be evaluated either analytically or 
numerically depending on the form of the densities of e and z. Assuming e has a Weibull 
) distribution, the survival function S(t) is given by, 

S(t) = g(z) dz = 

where g(z) is the density of z, 'F(z) is a function of z only, and H(t) does not depend on 
z. We note that both proportional hazard and scale change hazard models are special 
cases, when 'P(z) = z, and ¥(z) = : 0 respectively. 

Case 1: 

Let g(z) = iTi) • 7 (inverted gamma). In this case survival function S(t) is 

given by 



0 


(14) 


This integral can be evaluated numerically. In a special case when b/?=l, the expression in 
(14) can be simplified, that is. 


S(t) = 




\t l +<(>■ fua) 


I 

where /u = (a rj) 1 . From this, we get 


h(t) = 


A-/ 5 *’ 


b(t l +<i>-v) 


which approaches zero as t gets large 


( 15 ) 
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Case II: 

If log £ is distributed as a n(0, a 2 ), then e has the lognormal distribution. In this case, 


S(t/z) = P( T> t/z) = P( e>^j /:) 


= l-<t>[^-(logf-logfl-&logr)], 

where <t>(z) is the distribution function of the standard normal, and we get 


S(.) - JJ 


0 0 


V2?r • cr(x + log -fy) 


r ^ g(z) dxdz. 


(16) 


where x = s - log jj. This integral can be computed numerically, and then h(t) can be 
computed. 


Applications to RCS Thruster Valves 

As stated in the introduction, previous studies to estimate the reliability of a RCS thruster 
valve use either cycle time or soak time as the casual variable. It is quite possible that 
each of these two variables has a substantial effect on the valve contamination 
mechanism. It is also possible that other factors such as, location of valve on the orbiter, 
also contribute to failure mechanism. A preliminary analysis using logistic function can be 
used to decide which of the two independent variables has major effect on the 
contamination failure mechanism.. Let S denote the Soak time and C denote the cycle 
time, and define P(s,c) denote the probability of a valve failure for a given S=s and C=c. 

The logistic regression model assumes that the log(odds) is a linear function of 
independent variables. This procedure can be performed as follows: 

Step 1. 

Use data to fit 3 logistic functions independently: 


log (p(s,c) / (l-p(s,c) ) = a + f) s + 4> c 

(17) 

log(p(s) / (l-p(s)) = a + ps 

(18) 

log(p(c) / (1- p(c) ) = a+ (j)C 

(19) 


Step 2 

For each model compute the lack of fit statistic G 2 (with corresponding d.f.) 
Denote G 2 by G 2 for model ( 1 6+i) , i= 1 , 2, 3 
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Step 3 

3a. If G 2 2 gives a good fit , then soak time is important independent variable 
3b If G 3 2 gives a good fit , then cycle time is important independent variable 

Step 4 

4a. To test the hypothesis of ‘no cycle time effect’ 

compute G 2 2 - Gi 2 [increase in G 2 in using model (18) instead of (17)]. This 
difference is asymptotically distributed chi-squared with 1 d.f. 

4b. To test for 4 no soak time effect’ compute Gj 2 - G 1 2 , again this 
difference is asymptotically distributed chi-squared with 1 d.f. 

Step 5 

If both hypotheses in step 4a and 4b are rejected and Gi 2 indicates a good fit, 
then we conclude that both independent variables are contributing to failure. 

For the remainder of this section, let the variable T denote the Soak time and the variable 
Z denote the cycle time. Various models developed in this report can be used to estimate 
the reliability of RCS thruster valves. In particular, if T is weibull and z has a gamma 
distribution, then the hazard rate is given by equation (4). 

As mentioned before, with the advent of extended EVA’s and docking, a growing interest 
in the field performance of RCS thruster valves has developed. The reliability and safety 
requirements for the space shuttle program, have emphasized the need for adequate 
statistical methods for obtaining reliable safety guarantees. To achieve this objective, we 
need reliable sample data from various RCS thruster valves systems. Available field failure 
data on these valves is from a number of individual systems, each characterized by a serial 
number. The system may be put into, or taken out of, operation at different times. For 
each thruster valve, its (censored) life history which contains the following information is 
available: 

• The time when the valve was put into operation. 

• The location of the valve on the orbiter. 

• New or flushed valve 

• The time when the valve failed. 

• The time periods when the system was temporarily put out of 

operation (down periods). 

The location information is necessary if the objective is to find a location (or locations) on 
the orbiter where valves are more likely to fail. 

The Maximum Likelihood procedure is a powerful method of estimating parameters in 
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statistics. However, due to censoring, the likelihood function in this case will include, 
a. a set of lifetime observations 

T> , T 2 , T, , , Tni 

for those valves which have been replaced after failing; and 
b. a set of right censored observations 

T,\ Ti\ T 3 \ --- ,Ti«* 

for the valves that survived the flight time. Then the estimation is equivalent to fitting the 
parameters to the mixture distribution, so that the estimate 0 =(P> r\,X,y) is obtained as 
the value of 9 that maximizes the log - likelihood expression 

L(9 ) - log/(7) ) + X"log[l -F(T*\ 

In this case L(0) is quite complicated because of two types of observations 
(Ti’s and Ti*‘s), and excessive number of parameters in the model. This is an interesting 
problem. I plan to continue working on this problem and try to complete the problem 
during summer 96. 
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